CVE-2025-13773

Name of the Vulnerable Software and Affected Versions Print Invoice & Delivery Notes for WooCommerce versions up to and including 5.8.0

Description The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is susceptible to Remote Code Execution due to a missing capability check within the WooCommerce Delivery Notes::update function, the presence of PHP enabled in Dompdf, and a lack of proper escaping in the template.php file. This combination allows unauthenticated attackers to potentially execute code on the server. The WooCommerce Delivery Notes::update function is a key component involved in the issue.

Recommendations Versions up to and including 5.8.0 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the WooCommerce Delivery Notes::update function until a patch is available.